1. Field of the Invention
The present application relates to mobile network communications and, in some preferred embodiments, to changes in network attachment points during movement of a mobile node, station or device, commonly referred to in the mobile telephone field, by way of example, as a “hand-off.” The preferred embodiments of the present invention provide, e.g., mobility architectures for changes in mobile device attachment points to networks, such as, e.g., to changes in wireless access point connections to the Internet or to another network.
2. Background Discussion
Networks and Internet Protocol
There are many types of computer networks, with the Internet having the most notoriety. The Internet is a worldwide network of computer networks. Today, the Internet is a public and self-sustaining network that is available to many millions of users. The Internet uses a set of communication protocols called TCP/IP (i.e., Transmission Control Protocol/Internet Protocol) to connect hosts. The Internet has a communications infrastructure known as the Internet backbone. Access to the Internet backbone is largely controlled by Internet Service Providers (ISPs) that resell access to corporations and individuals.
With respect to IP (Internet Protocol), this is a protocol by which data can be sent from one device (e.g., a phone, a PDA [Personal Digital Assistant], a computer, etc.) to another device on a network. There are a variety of versions of IP today, including, e.g., IPv4, IPv6, etc. Each host device on the network has at least one IP address that is its own unique identifier.
IP is a connectionless protocol. The connection between end points during a communication is not continuous. When a user sends or receives data or messages, the data or messages are divided into components known as packets. Every packet is treated as an independent unit of data.
In order to standardize the transmission between points over the Internet or the like networks, an OSI (Open Systems Interconnection) model was established. The OSI model separates the communications processes between two points in a network into seven stacked layers, with each layer adding its own set of functions. Each device handles a message so that there is a downward flow through each layer at a sending end point and an upward flow through the layers at a receiving end point. The programming and/or hardware that provides the seven layers of function is typically a combination of device operating systems, application software, TCP/IP and/or other transport and network protocols, and other software and hardware.
Typically, the top four layers are used when a message passes from or to a user and the bottom three layers are used when a message passes through a device (e.g., an IP host device). An IP host is any device on the network that is capable of transmitting and receiving IP packets, such as a server, a router or a workstation. Messages destined for some other host are not passed up to the upper layers but are forwarded to the other host. In the OSI and other similar models, IP is in Layer-3, the network layer. The layers of the OSI model are listed below.
Layer 7 (i.e., the application layer) is a layer at which, e.g., communication partners are identified, quality of service is identified, user authentication and privacy are considered, constraints on data syntax are identified, etc.
Layer 6 (i.e., the presentation layer) is a layer that, e.g., converts incoming and outgoing data from one presentation format to another, etc.
Layer 5 (i.e., the session layer) is a layer that, e.g., sets up, coordinates, and terminates conversations, exchanges and dialogs between the applications, etc.
Layer-4 (i.e., the transport layer) is a layer that, e.g., manages end-to-end control and error-checking, etc.
Layer-3 (i.e., the network layer) is a layer that, e.g., handles routing and forwarding, etc.
Layer-2 (i.e., the data-link layer) is a layer that, e.g., provides synchronization for the physical level, does bit-stuffing and furnishes transmission protocol knowledge and management, etc. The Institute of Electrical and Electronics Engineers (IEEE) sub-divides the data-link layer into two further sub-layers, the MAC (Media Access Control) layer that controls the data transfer to and from the physical layer and the LLC (Logical Link Control) layer that interfaces with the network layer and interprets commands and performs error recovery.
Layer 1 (i.e., the physical layer) is a layer that, e.g., conveys the bit stream through the network at the physical level. The IEEE sub-divides the physical layer into the PLCP (Physical Layer Convergence Procedure) sub-layer and the PMD (Physical Medium Dependent) sub-layer.
In this document, layers higher than layer-2 (such as, e.g., layers including the network layer or layer-3 in the OSI model and the like) are referred to as the higher-layers.
Wireless Networks
Wireless networks can incorporate a variety of types of mobile devices, such as, e.g., cellular and wireless telephones, PCs (personal computers), laptop computers, wearable computers, cordless phones, pagers, headsets, printers, PDAs, etc. For example, mobile devices may include digital systems to secure fast wireless transmissions of voice and/or data. Typical mobile devices include some or all of the following components: a transceiver (i.e., a transmitter and a receiver, including, e.g., a single chip transceiver with an integrated transmitter, receiver and, if desired, other functions); an antenna; a processor; one or more audio transducers (for example, a speaker or a microphone as in devices for audio communications); electromagnetic data storage (such as, e.g., ROM, RAM, digital data storage, etc., such as in devices where data processing is provided); memory; flash memory; a full chip set or integrated circuit; interfaces (such as, e.g., USB, CODEC, UART, PCM, etc.); and/or the like.
Wireless LANs (WLANs) in which a mobile user can connect to a local area network (LAN) through a wireless connection may be employed for wireless communications. Wireless communications can include, e.g., communications that propagate via electromagnetic waves, such as light, infrared, radio, microwave. There are a variety of WLAN standards that currently exist, such as, e.g., Bluetooth, IEEE 802.11, and HomeRF.
By way of example, Bluetooth products may be used to provide links between mobile computers, mobile phones, portable handheld devices, personal digital assistants (PDAs), and other mobile devices and connectivity to the Internet. Bluetooth is a computing and telecommunications industry specification that details how mobile devices can easily interconnect with each other and with non-mobile devices using a short-range wireless connection. Bluetooth creates a digital wireless protocol to address end-user problems arising from the proliferation of various mobile devices that need to keep data synchronized and consistent from one device to another, thereby allowing equipment from different vendors to work seamlessly together. Bluetooth devices may be named according to a common naming concept. For example, a Bluetooth device may possess a Bluetooth Device Name (BDN) or a name associated with a unique Bluetooth Device Address (BDA). Bluetooth devices may also participate in an Internet Protocol (IP) network. If a Bluetooth device functions on an IP network, it may be provided with an IP address and an IP (network) name. Thus, a Bluetooth Device configured to participate on an IP network may contain, e.g., a BDN, a BDA, an IP address and an IP name. The term “IP name” refers to a name corresponding to an IP address of an interface.
An IEEE standard, IEEE 802.11, specifies technologies for wireless LANs and devices. Using 802.11, wireless networking may be accomplished with each single base station supporting several devices. In some examples, devices may come pre-equipped with wireless hardware or a user may install a separate piece of hardware, such as a card, that may include an antenna. By way of example, devices used in 802.11 typically include three notable elements, whether or not the device is an access point (AP), a mobile station (STA), a bridge, a PCMCIA card or another device: a radio transceiver; an antenna; and a MAC (Media Access Control) layer that controls packet flow between points in a network.
In addition, Multiple Interface Devices (MIDs) may be utilized in some wireless networks. MIDs may contain two independent network interfaces, such as a Bluetooth interface and an 802.11 interface, thus allowing the MID to participate on two separate networks as well as to interface with Bluetooth devices. The MID may have an IP address and a common IP (network) name associated with the IP address.
Wireless network devices may include, but are not limited to Bluetooth devices, Multiple Interface Devices (MIDs), 802.11x devices (IEEE 802.11 devices including, e.g., 802.11a, 802.11b and 802.11g devices), HomeRF (Home Radio Frequency) devices, Wi-Fi (Wireless Fidelity) devices, GPRS (General Packet Radio Service) devices, 3 G cellular devices, 2.5 G cellular devices, GSM (Global System for Mobile Communications) devices, EDGE (Enhanced Data for GSM Evolution) devices, TDMA type (Time Division Multiple Access) devices, or CDMA type (Code Division Multiple Access) devices, including CDMA2000. Each network device may contain addresses of varying types including but not limited to an IP address, a Bluetooth Device Address, a Bluetooth Common Name, a Bluetooth IP address, a Bluetooth IP Common Name, an 802.11 IP Address, an 802.11 IP common Name, or an IEEE MAC address.
Wireless networks can also involve methods and protocols found in, e.g., Mobile IP (Internet Protocol) systems, in PCS systems, and in other mobile network systems. With respect to Mobile IP, this involves a standard communications protocol created by the Internet Engineering Task Force (IETF). With Mobile IP, mobile device users can move across networks while maintaining their IP Address assigned once. See Request for Comments (RFC) 3344. NB: RFCs are formal documents of the Internet Engineering Task Force (IETF). Mobile IP enhances Internet Protocol (IP) and adds means to forward Internet traffic to mobile devices when connecting outside their home network. Mobile IP assigns each mobile node a home address on its home network and a care-of-address (CoA) that identifies the current location of the device within a network and its subnets. When a device is moved to a different network, it receives a new care-of address. A mobility agent on the home network can associate each home address with its care-of address. The mobile node can send the home agent a binding update each time it changes its care-of address using, e.g., Internet Control Message Protocol (ICMP).
In basic IP routing (i.e. outside mobile IP), routing mechanisms rely on the assumptions that each network node always has a constant attachment point to, e.g., the Internet and that each node's IP address identifies the network link it is attached to. In this document, the terminology “node” includes a connection point, which can include, e.g., a redistribution point or an end point for data transmissions, and which can recognize, process and/or forward communications to other nodes. For example, Internet routers can look at, e.g., an IP address prefix or the like identifying a device's network. Then, at a network level, routers can look at, e.g., a set of bits identifying a particular subnet. Then, at a subnet level, routers can look at, e.g., a set of bits identifying a particular device. With typical mobile IP communications, if a user disconnects a mobile device from, e.g., the Internet and tries to reconnect it at a new subnet, then the device has to be reconfigured with a new IP address, a proper netmask and a default router. Otherwise, routing protocols would not be able to deliver the packets properly.
Handoffs and Changing Network Attachment Points
A handoff is an act in which a mobile station changes its network attachment point from one point to another, where network attachment points can include, e.g., base stations and IP (Internet Protocol) routers. When a handoff occurs with a change in attaching, for example, base stations and IP routers, it typically includes a layer-2 handoff and a layer-3 handoff, respectively. The layer-2 handoff and the layer-3 handoff occur at about the same time. During any handoff, the system needs to re-establish states maintained between the mobile station and the new network attachment point. These states related to handoff are also referred to as handoff contexts or simply as “contexts.”
There are two types of contexts, transferable contexts and non-transferable contexts. The transferable contexts are transferable between the old and new attachment points while the non-transferable contexts need to be established either from scratch or by using transferable contexts. Illustrative transferable contexts can include, e.g., authentication contexts that are used, e.g., for re-authenticating the mobile and QoS (Quality of Service) contexts that are used, e.g., for allocating network resources sufficiently to provide a particular grade of service for the mobile. A dynamically assigned IP address of the mobile is an illustrative non-transferable context. Layer-2 and layer-3 cipher keys, such as TKIP (Temporal Key Integrity Protocol) and CCMP (Counter mode with CBC-MAC Protocol) cipher keys in 802.11i (see, e.g., Reference #11 incorporated herein below) and IPsec AH (Authentication Header) and ESP (Encapsulation Security Payload) cipher keys (see, e.g., References #15, #16 and #17 incorporated herein below) that are used for protecting data packets transmitted between the mobile station and an access point (AP) or router, are other illustrative non-transferable contexts, since those keys are associated with a particular pair of MAC (Media Access Control) or IP addresses of the two entities and need to be re-established based on negotiations between them.
For reference, as discussed above, 802.11 is a family of specifications for wireless local area networks (WLANs) developed by a working group of the Institute of Electrical and Electronics Engineers (IEEE), which includes, e.g., specifications in the families 802.11, 802.11a, 802.11b, and 802.11g which use ethernet protocol and CSMA/CA (carrier sense multiple access with collision avoidance) for path sharing. See, e.g., Reference #13 incorporated herein below. In addition, 802.11i is a developing IEEE standard for security in WLANs. In addition, IPsec (Internet Protocol Security) is a framework for a set of protocols for security at the network or packet processing layer of network communication. In addition, a MAC address involves, e.g., a device's unique hardware address and can be used by the media access control sub-layer of the data-link layer, while an IP address involves, e.g., a number that identifies each sender or receiver of information that is sent in packets across, e.g., the Internet (such as, e.g., a 32 bit number in the most widely installed level of the Internet Protocol [IP], a 128 bit number in IPv6, a Classless Inter-Domain Routing (CIDR) network address and/or the like).
Transferring the transferable contexts from one network attachment point to another, before or after handoff, can reduce the handoff delay. A number of protocols, such as, e.g., IEEE 802.11f protocol (i.e., 802.11f is an inter AP protocol for exchange of information between 802.11 access points, such as information related to a mobile station between access points—see, e.g., Reference #12 incorporated herein below) and an IP-layer Context Transfer Protocol (see, e.g., Reference #14 incorporated herein below) can be used for this purpose. On the other hand, a delay for re-establishing non-transferable contexts is accumulated over a series of negotiations on each context, though some of the non-transferable contexts may be negotiated in parallel. Among other things, this delay can be problematic.
There are two cases in which this delay for negotiating non-transferable contexts may not become a problem. The first case is where an underlying radio link-layer uses CDMA (Code Division Multiple Access). In this first case, it is possible for the mobile station to establish certain contexts with the new base station while it is still communicating via the old base station, by using a so called soft handoff mechanism in which different CDMA codes can be used by the mobile at the same time for communicating with the different base stations in an overlapping radio coverage. The second case is where the mobile station has multiple interfaces and the handoff occurs across the interfaces. In this second case, essentially the same effect as a CDMA soft handoff can be achieved by allowing these interfaces to be operated at the same time.
The non-transferable contexts are most problematic in environments where neither of the above two schemes is available. For example, a mobile station with a single IEEE 802.11 wireless LAN interface cannot use a CDMA soft handoff scheme or an interface-switching scheme.
In view of this problem, IEEE 802.11 TGi is developing a new scheme named pre-authentication in which an IEEE 802.11i station (STA) that has been authenticated to and associated with an access point (AP) is allowed to perform IEEE 802.1X authentication with other access points through the currently associated access point before it associates with them. The IEEE 802.11i pre-authentication also allows 802.11i cipher keys to be established between the station and the non-associated APs.
However, the applicability of IEEE 802.11i pre-authentication is limited to mobile stations and access points in the same LAN, since IEEE 802.1X is defined to operate in a LAN. The original 802.11i pre-authentication documentation (see, e.g., Reference #1 incorporated herein below) does not set forth details for extending IEEE 802.11i pre-authentication to operating over the IP-layer such that a mobile station can pre-authenticate to APs in different LANs.
For reference, 802.11i is a wireless networking standard that addresses some security concerns in 802.11 and 802.1X is a group of WLAN standards developed as part of overall IEEE 802.11 WLAN support (see, e.g., References #1 and #10 incorporated herein below). Under 802.11, the presence of the other access points can be detected through active or passive scanning. In passive scanning, the mobile stations scan for beacon signals (including, e.g., Service Set Identifiers [SSIDS] and other key information) from the APs, while in active scanning the mobile stations send probe frames to elicit probe responses from the APs. For further reference, 802.11i pre-authentication involves an authenticator entity that enforces authentication before allowing access, a supplicant device (e.g., a mobile station) that requests access to services available via the authenticator (e.g., an access point) and an authentication server (such as, e.g., a Remote Authentication Dial-in User Service server or the like) that performs an authentication function (i.e., checking credentials of the supplicant) and responds to the authenticator to identify if the supplicant is authorized or not. In some embodiments, the authenticator and the authenticator server can be collocated, but they can also be separate.
While a variety of systems and methods are known, there remains a need for improved systems and methods. The preferred embodiments provide substantial improvements over and/or advances beyond the above and/or other systems and methods, including, e.g., systems and methods described in the following references, the entire disclosures of which references are each incorporated herein by reference:                Reference #1: B. Aboba, “IEEE 802.1X Pre-Authentication”, IEEE 802.11-02/389r1, June 2002.        Reference #2: B. Aboba and D. Simon, “PPP EAP TLS Authentication Protocol”, RFC 2716, October 1999.        Reference #3: L. Blunk, J. Vollbrecht, B. Aboba, J. Carlson and H. Levkowetz, “Extensible Authentication Protocol (EAP), Internet-Draft, Work in progress (to obsolete RFC 2284, May 2003 (see, also, e.g., November, 2003 document).        Reference #4: R. Droms and W. Arbaugh, “Authentication for DHCP Messages”, RFC 3118, June 2001.        Reference #5: R. Droms, “Dynamic Host Configuration Protocol,” RFC 2131, March 1997.        Reference #6: P. Funk, S. Blake-Wilson, “EAP Tunneled TLS Authentication Protocol (EAP-TTLS)”, Internet-Draft, Work in progress, November 2002 (see also, e.g., August, 2003 document).        Reference #7: D. Forsberg, Y. Ohba, B. Patil, H. Tschofenig and A. Yegin, “Protocol for Carrying Authentication for Network Access (PANA)”, Internet-Draft, Work in progress, March 2003 (see also, e.g., October, 2003 document).        Reference #8: R. Glenn and S. Kent, “The Null Encryption Algorithm and Its Use With IPsec,” RFC 2410, November 1998.        Reference #9: D. Harkins and D. Carrel, “The Internet Key Exchange (IKE)”, RFC 2409, November 1998.        Reference #10: IEEE Standard for Local and Metropolitan Area Networks, “Port-Based Network Access Control”, IEEE Std 802.1X-2001.        Reference #11: IEEE Standard for Local and Metropolitan Area Networks, “Wireless Medium Access Control (MAC) and physical layer (PHY) specifications: Medium Access Control (MAC) Security Enhancements,” IEEE Std 802.11i/D4.0, May 2003 (see also, e.g., IEEE Std 802.11i/D7.0, October 2003 document).        Reference #12: IEEE Standard for Local and Metropolitan Area Networks, “Draft Recommended Practice for Multi-Vendor Access Point Interoperability via an Inter-Access Point Protocol Across Distribution Systems Supporting IEEE 802.11 Operation,” IEEE P802.11F/D5, January 2003.        Reference #13: IEEE Standard for Local and Metropolitan Area Networks, “Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications,” ANSI/IEEE Std 802.11, 1999 Edition, 1999.        Reference #14: J. Loughney, M. Nakhjiri, C. Perkins and R. Koodli, “Context Transfer Protocol,” Internet-Draft, Work in progress, June 2003 (see also, e.g., October, 2003 document).        Reference #15: C. Kaufman, “Internet Key Exchange (IKEv2) Protocol”, Internet-Draft, Work in progress, Apr. 2003 (see also, e.g., Oct. 9, 2003 and January, 2004 documents).        Reference #16: S. Kent and R. Atkinson, “IP Authentication Header,” RFC 2402, November 1998.        Reference #17: S. Kent and R. Atkinson, “IP Encapsulating Security Payload (ESP),” RFC 2406, November 1998.        Reference #18: T. Kivinen, “DHCP over IKE”, Internet-Draft, Work in progress, April 2003.        Reference #20: M. Liebsch, A. Singh, H. Chaskar and D. Funato, “Candidate Access Router Discovery”, Internet-Draft, work in Progress, March 2003 (see also, e.g., September, 2003 and November, 2003 documents).        Reference #21: A. Palekar, D. Simon, G. Zom and S. Josefsson, “Protected EAP Protocol (PEAP)”, Internet-Draft, Work in Progress, Mar. 2003 (see also “Protected EAP Protocol (PEAP) Version 2,” October, 2003).        Reference #22: B. Patel, B. Aboba, S. Kelly and V. Gupta, “Dynamic Host Configuration Protocol (DHCPv4) Configuration of IPsec Tunnel Mode”, RFC 3456, January 2003.        Reference #23: J. Puthenkulam, V. Lortz, A. Palekar and D. Simon, “The Compound Authentication Binding Problem”, Internet-Draft, Work in Progress, March 2003 (see also, e.g., October, 2003 document).        Reference #24: R. Seifert, “The Switch Book—The Complete Guide to LAN Switching Technology”, Wiley Computer Publishing, ISBN 0-471-34586-5.        Reference #25: Y. Sheffer, H. Krawczyk and B. Aboba, “PIC, A Pre-IKE Credential Provisioning Protocol”, Internet-Draft, Work in progress, October 2002.        Reference #26: H. Tschofenig, A. Yegin and D. Forsburg, “Bootstrapping RFC3118 Delayed Authentication using PANA”, Internet-Draft, June 2003 (see also, e.g., October, 2003 document).        Reference #27: M. Kulkami, A Patel and K. Leung, “Mobile IPv4 Dynamic Home Agent Assignment”, IETF Internet-Draft, January 8, 2004.        